{"id":"CVE-2025-47771","aliases":["GHSA-f5cx-h789-j959"],"url":"https://o3.security/vulnerability/CVE-2025-47771","summary":"PowSyBl Core allows deserialization of untrusted SparseMatrix data","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that\ncan lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method\nof the `SparseMatrix` class.\nThis method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be\nexposed to untrusted input in at least two use cases:\n- A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into\na `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege\nlevels.\n- A user adopts the method for a local tool but receives the `InputStream` from external sources.\n\n#### Am I impacted?\nYou are vulnerable if you import non-controlled serialized `SparseMatrix` objects.\n\n\n### Patches\ncom.powsybl:powsybl-math:6.7.2 and higher\n\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nDo not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).\n\n### References\n[powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)","published":"2025-06-19T23:41:41.357Z","modified":"2026-10-28T11:01:47.581702520Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.powsybl:powsybl-math","fixedVersion":"6.7.2"}],"fix":{"url":"https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd","label":"powsybl/powsybl-core@8ed16ce"},"references":[{"type":"WEB","url":"https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47771.json"},{"type":"ADVISORY","url":"https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47771"},{"type":"FIX","url":"https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd"},{"type":"PACKAGE","url":"https://github.com/powsybl/powsybl-core"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T11:01:47.581702520Z"}}